0.22.0

⚠️ Security fix and breaking change

This release fixes an OAuth login CSRF vulnerability
(GHSA-wgrh-7h2j-rg46,
CWE-352), reported by @mohammedix88 (cystack.ps redteam).

SSOBase.requires_state defaulted to False, so the state validation added in 0.19.0 never ran
unless you opted in. Any application on the default configuration accepted a callback with nothing
bound to the caller's session. Upgrading is recommended for all users.

requires_state now defaults to True. A login flow that does not carry the sso_state cookie
back to your callback will now fail with 401 State cookie not found. This affects you if:

• you do not use the SSO instance as a context manager (async with sso:), so no state is generated
• your login and callback endpoints are served from different hosts, so the browser does not return
  the cookie
• you build the redirect yourself from get_login_url, which returns a URL and sets no cookie.
  This now emits a SecurityWarning at login time, so you will see it before your users do

If you cannot carry the cookie, you can opt out per instance and keep the old behaviour, at the cost
of losing CSRF protection:

sso = GoogleSSO(client_id, client_secret, redirect_uri)
sso.requires_state = False

The sso_state cookie is now also set HttpOnly, SameSite=lax, and Secure unless
allow_insecure_http is enabled.

What's Changed

• chore(deps): bump the all group across 1 directory with 5 updates by @dependabot[bot] in #297
• chore(deps-dev): bump the all group with 4 updates by @dependabot[bot] in #298
• chore(deps): bump the all group with 4 updates by @dependabot[bot] in #299
• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #300
• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #301
• chore(deps-dev): bump uvicorn from 0.52.0 to 0.52.1 in the all group by @dependabot[bot] in #302
• chore(deps-dev): bump the all group with 3 updates by @dependabot[bot] in #303
• chore(deps-dev): bump the all group with 3 updates by @dependabot[bot] in #305
• chore(deps-dev): bump the all group with 2 updates by @dependabot[bot] in #306
• fix!: enforce OAuth state validation by default by @autonomous-bot-agent-tomasvotava[bot] in #307

New Contributors

• @autonomous-bot-agent-tomasvotava[bot] made their first contribution in #307

Full Changelog: 0.21.1...0.22.0

0.21.1

Dependencies-only release

What's Changed

• chore(deps): bump the all group across 1 directory with 6 updates by @dependabot[bot] in #280
• chore(deps): bump the all group with 4 updates by @dependabot[bot] in #281
• chore(deps-dev): bump the all group with 4 updates by @dependabot[bot] in #282
• chore(deps): bump the all group with 2 updates by @dependabot[bot] in #283
• chore(deps): bump the all group across 1 directory with 8 updates by @dependabot[bot] in #286
• chore(deps): bump the all group across 1 directory with 8 updates by @dependabot[bot] in #289
• chore(deps): bump the all group across 1 directory with 6 updates by @dependabot[bot] in #291
• chore(deps-dev): bump the all group with 2 updates by @dependabot[bot] in #292
• chore(deps): bump vulnerable transitive deps (pillow, cairosvg, urllib3) by @tomasvotava in #293
• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #294
• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #295

Full Changelog: 0.21.0...0.21.1

0.21.0

What's Changed

• feat: remove python 3.9 support, add python 3.14 support by @tomasvotava in #274
• chore(deps): bump the all group with 6 updates by @dependabot[bot] in #275
• chore(deps): bump the all group across 1 directory with 7 updates by @dependabot[bot] in #277
• Added tidal and apple providers by @john-9474 in #278

Full Changelog: 0.20.0...0.21.0

0.20.0

What's Changed

• chore(deps): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #270
• chore(deps): bump the all group across 1 directory with 5 updates by @dependabot[bot] in #273
• feat: Add soundcloud provider by @john-9474 in #272

New Contributors

• @john-9474 made their first contribution in #272

Full Changelog: 0.19.0...0.20.0

0.19.0

️⚠️ A critical OAuth login CSRF vulnerability caused by missing state validation was
reported by @davidbors-snyk (Snyk Security Labs)
in #266 and has been resolved
in version 0.19.0.

Starting with fastapi-sso==1.0.0, OAuth state will be backed by a pluggable server-side store
(in-memory by default, with support for external stores such as Redis).

What's Changed

• chore(deps): bump the all group with 11 updates by @dependabot[bot] in #230
• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #231
• chore(deps): bump the all group with 6 updates by @dependabot[bot] in #232
• chore(deps): bump the all group with 4 updates by @dependabot[bot] in #233
• chore(deps-dev): bump the all group with 3 updates by @dependabot[bot] in #234
• chore(deps-dev): bump the all group with 2 updates by @dependabot[bot] in #235
• chore(deps): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #237
• chore(deps): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #239
• chore(deps-dev): bump the all group across 1 directory with 4 updates by @dependabot[bot] in #241
• chore(deps): bump the all group with 5 updates by @dependabot[bot] in #242
• chore(deps): bump the all group across 1 directory with 10 updates by @dependabot[bot] in #247
• chore(deps-dev): bump the all group with 3 updates by @dependabot[bot] in #248
• chore(deps-dev): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #251
• chore(deps-dev): bump the all group with 3 updates by @dependabot[bot] in #252
• chore(deps-dev): bump the all group with 2 updates by @dependabot[bot] in #253
• chore(deps): bump the all group with 2 updates by @dependabot[bot] in #254
• chore(deps): bump the all group across 1 directory with 12 updates by @dependabot[bot] in #259
• fix: enforce state validation by @davidbors-snyk in #267
• chore(deps): bump the all group across 1 directory with 7 updates by @dependabot[bot] in #265
• docs(#266): warn against using state as an arbitrary data transport by @tomasvotava in #269

New Contributors

• @davidbors-snyk made their first contribution in #267

Full Changelog: 0.18.0...0.19.0

0.18.0

What's Changed

Removed support for python 3.8

• chore: add Python 3.13 to testing and linting workflows by @tomasvotava in #226
• chore: update Python version to 3.12 and improve documentation workflow by @tomasvotava in #227
• chore(deps-dev): bump the all group across 1 directory with 2 updates by @dependabot in #228
• feat:use id token for linkedin userinfo by @tomasvotava in #229

Full Changelog: 0.17.0...0.18.0

0.17.0

What's Changed

• docs: update guide on return urls by @tomasvotava in #206
• feat: add Discord and Bitbucket providers by @tomasvotava in #207
• bump: 0.17.0 by @tomasvotava in #208

Full Changelog: 0.16.0...0.17.0

Thanks @afi-dev for the contribution!

0.16.0

Please see the security notice before upgrading.

What's Changed

• chore(deps): bump the all group across 1 directory with 6 updates by @dependabot in #171
• chore(deps): bump the all group with 5 updates by @dependabot in #172
• chore(deps): bump the all group with 3 updates by @dependabot in #176
• chore(deps): bump the all group across 1 directory with 10 updates by @dependabot in #183
• chore(deps-dev): bump the all group with 4 updates by @dependabot in #184
• chore(deps): bump the all group across 1 directory with 7 updates by @dependabot in #188
• chore(deps): bump the all group across 1 directory with 10 updates by @dependabot in #192
• chore(deps): bump the all group across 1 directory with 6 updates by @dependabot in #195
• added Seznam SSO provider by @TomasKoutek in #194
• chore(deps): bump the all group across 1 directory with 8 updates by @dependabot in #203
• chore(deps-dev): bump the all group with 2 updates by @dependabot in #204
• feat!: utilize async lock to overcome dangerous race conditions by @tomasvotava in #189
• bump: 0.16.0 by @tomasvotava in #205

New Contributors

• @TomasKoutek made their first contribution in #194

Full Changelog: 0.15.0...0.16.0

0.15.0

What's Changed

• chore(deps): bump the all group across 1 directory with 10 updates by @dependabot in #158
• chore: switch from pylint to ruff by @tomasvotava in #160
• fix: default e-mail "" was invalid and should be None by @tomasvotava in #166
• chore: improve callback logging by @tomasvotava in #167

Full Changelog: 0.14.2...0.15.0

0.14.2

What's Changed

• [hotfix] add naver email, nickname fields(optinal). by @dalbodeule in #153

Full Changelog: 0.14.1...0.14.2